1.Introduction — The Post-Quantum Migration Imperative

The cryptographic infrastructure underpinning global financial systems — RSA, ECDSA, and Diffie-Hellman key exchange — is predicated on the computational intractability of integer factorization and discrete logarithm problems. A sufficiently powerful quantum computer running Shor's algorithm renders all three problems tractable in polynomial time, invalidating the security guarantees on which SWIFT messaging, RTGS settlement rails, institutional custody, and correspondent banking currently depend.1

The National Institute of Standards and Technology finalized four post-quantum cryptographic standards in August 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA), and FIPS 206 (SLH-DSA-SHA2). Concurrently, NIST deprecated RSA and ECC for federal use with a mandatory migration deadline of 2030. OSFI, the Bank for International Settlements Innovation Hub, and the Financial Stability Board have each issued guidance indicating that financial institutions must demonstrate post-quantum readiness within their strategic planning horizons.

However, the migration challenge for financial institutions is not merely algorithmic. Legacy hardware security modules (HSMs), which form the trust anchor of most payment authorization pipelines, present a structural vulnerability that algorithm substitution alone does not resolve: the persistence of private keys in tamper-resistant storage. A key that is stored — however securely — can be exfiltrated through side-channel attacks, insider compromise, supply chain interdiction, or future vulnerabilities in the HSM firmware. Migrating from RSA-2048 to ML-DSA-87 within an HSM that retains the private key long-term substitutes one algorithm for another without addressing the underlying key-persistence attack surface.

This paper describes an architecture that eliminates key persistence as a vulnerability class entirely.

2.The Harvest Now, Decrypt Later Threat Model

Nation-state adversaries are actively collecting encrypted financial communications today with the explicit intent of decrypting them retroactively once quantum computing capability matures — a strategy termed Harvest Now, Decrypt Later (HNDL).2 Classified assessments from the NSA, GCHQ, and CSE have indicated that cryptographically-relevant quantum computers (CRQCs) may be achievable within a 5–10 year horizon under well-resourced programs.

For financial institutions, the HNDL threat has two distinct dimensions. First, the confidentiality of historical transaction records: wire details, correspondent relationships, sovereign reserve movements, and custody positions collected today become decipherable when CRQCs arrive. Second, and more critically, the integrity of authorization chains: digital signatures applied today using RSA or ECDSA may be forgeable retroactively, enabling adversaries to fabricate transaction provenance records that appear indistinguishable from genuine historical authorizations.

The latter threat is not merely theoretical. Any institution that archives payment authorizations signed under classical algorithms is accumulating a liability whose magnitude grows proportionally to the assets those authorizations govern.

3.Limitations of Legacy HSM Architectures

Current payment authorization infrastructure relies on Hardware Security Modules certified to FIPS 140-2/3 or Common Criteria EAL4+. These devices protect private keys through tamper-evident enclosures, active shielding, and secure key storage — but they do not eliminate key persistence. A private key enrolled in a legacy HSM exists continuously from enrollment through revocation, typically spanning months or years. This design reflects a reasonable engineering trade-off in the pre-quantum era, but it creates a concentrated, long-lived attack target.

3.1 The PQC Data Inflation Barrier

Beyond algorithm vulnerability, legacy HSMs and banking infrastructure present a practical migration bottleneck: lattice-based signature schemes generate significantly larger key material and signatures than the RSA and ECC primitives that existing payment infrastructure was designed to carry.

The cryptographic payload is identical in both integration paths. The architectural question is not whether to accept the lattice-based overhead — it is unavoidable under any NIST-standardized PQC scheme — but where that overhead lands: embedded inside legacy payment rails (catastrophic) or attached as an external non-breaking authorization record (zero disruption).

3.2 Three Vectors of Traditional PQC Integration Failure

Attempting to integrate ML-DSA-87 by upgrading existing core payment applications triggers three independent failure modes before a single business logic change is required.

1. Database Schema Truncation. Banking middleware and internal routing systems commonly define security token fields with rigid column sizes (e.g., VARCHAR(512)), engineered during an era when 256-byte RSA signatures represented the upper bound. A 4,595-byte ML-DSA-87 signature inserted into a 512-byte database column produces immediate data truncation, corrupted audit logs, and transaction database crashes. Remediating every security-bearing field across a global bank's internal application estate — which may span 200 or more discrete systems and millions of lines of legacy code — represents a multi-year, multi-hundred-million-dollar remediation programme.

2. Network MTU Fragmentation. Financial transaction networks are engineered for sub-millisecond round-trip times and optimized around standard network Maximum Transmission Unit (MTU) sizes of 1,500 bytes. A complete ML-DSA-87 authorization payload (public key + signature = 7,187 bytes) exceeds this limit by a factor of nearly 5×. Mandatory packet fragmentation introduces out-of-order delivery, retransmission overhead, and unpredictable latency spikes across high-volume SWIFT parsing engines and real-time gross settlement (RTGS) systems where deterministic timing is a regulatory requirement.

3. HSM Performance Collapse. Classical rack-mounted HSMs (Thales Luna Network HSM, Entrust nShield, IBM 4769) implement custom ASIC coprocessors hardcoded to accelerate modular exponentiation (RSA) and elliptic-curve point multiplication (ECDSA/ECDH). These processors have no native instruction path for the polynomial matrix arithmetic required by ML-DSA-87. Software-patching a classical HSM to support lattice-based operations forces the computation into software emulation on the HSM's general-purpose management processor, collapsing verified signing throughput by up to 90% of rated TPS. For institutions operating at 50,000+ transactions per second, this constitutes systemic capacity failure. Full fleet replacement at $40,000–$100,000 per unit across thousands of deployed devices represents an additional $200M–$1.5B in hardware expenditure before any software remediation costs.

The QSK architecture sidesteps each constraint by treating each authorization as a fully independent ceremony with no dependency on retained key state, enabling the performance profile measured in Section 6 of this paper.

5.Benchmark Methodology

The software implementation evaluated in this paper is the PALLAS Auth SDK v0.1.0, a Node.js/TypeScript package implementing the full QSK ceremony. All measurements were collected on a commodity Windows 11 machine with no hardware cryptographic acceleration. The benchmark was executed using Node.js ≥ 18 with the @noble/post-quantum library (v0.2.1) for ML-DSA-87 operations and @noble/hashes (v1.4.0) for HKDF-SHA-512 derivation.

Each measurement reflects the complete end-to-end ceremony latency from the initial QRNG fetch call through the return of a verified signed result. Step-level timing is captured using inline performance.now() calls bracketing each discrete operation. A warm-up ceremony was executed prior to the benchmark run to eliminate JIT compilation and WASM initialization effects from reported figures.

In addition to the formal benchmark, five live transaction authorization payloads representing realistic financial instrument types were processed through the REST API layer (POST /authenticate) to validate end-to-end API behavior and confirm that all signed records pass independent post-hoc verification via POST /verify.

7.Security Analysis

7.1 Key Extraction Attack Surface

In a legacy HSM, a successful side-channel attack, firmware exploit, or physical tamper event may recover a private key that remains valid for the remainder of its enrollment period — potentially years of future authorizations. Under the QSK architecture, the attack window is bounded by the ceremony duration (measured mean: 23.91 ms warm, CSPRNG concurrency=1). Even if an adversary could execute a perfect memory acquisition attack at arbitrary times, the probability of capturing a signing key in its ~24 ms existence window, across a process that may perform tens of authorizations per day, is negligibly small. On the physical PALLAS hardware, key material never exits the EAL6+ secure element boundary, reducing this attack surface further to the constraints of the Infineon SLC27's tamper-response circuitry.

7.2 The Dilithium Gate as Authorization Enforcement

The mandatory post-signing verification step — which we term the Dilithium Gate — serves a purpose beyond correctness checking. It ensures that no authorization result is returned to a calling system unless the signature is cryptographically valid against the public key derived from the same ceremony. In the software SDK, this is enforced in code. On the physical PALLAS hardware (Infineon SLC27 TEGRION EAL6+), this gate is enforced at the silicon level: the secure element's output is conditioned on the verification result, and the verification cannot be bypassed by software. All 4,200 benchmark ceremonies across the full concurrency matrix passed the Dilithium Gate unconditionally.

7.3 Forward Secrecy Properties

Classical Perfect Forward Secrecy (PFS) as implemented in TLS 1.3 protects the confidentiality of session keys: compromise of a long-term private key does not reveal past session keys, because each session key is ephemeral. The QSK architecture extends this property to the signing domain and eliminates the long-term private key entirely. There is no long-term key to compromise. Chrono-Isolated Secrecy therefore provides stronger guarantees than PFS: not only are past sessions protected from future key compromise, but there is no future key — each ceremony is cryptographically independent and self-contained.

7.4 Algorithm Longevity

ML-DSA-87 is the highest security level offered by FIPS 204, targeting security equivalent to AES-256 against both classical and quantum adversaries. The underlying mathematical problem — the Module Learning With Errors (MLWE) problem over structured lattices — is not known to be vulnerable to quantum algorithms. Shor's algorithm does not apply to lattice problems. Grover's algorithm provides at most a quadratic speedup against symmetric primitives, which is accounted for in the FIPS 204 security level parameterization. The QSK architecture's algorithm-agnostic design (patent Claim 60) further ensures that the architecture remains valid if ML-DSA-87 is superseded by a future standard, requiring only a parameter update rather than architectural redesign.

8.Integration Pathway for Financial Institutions

The PALLAS Auth SDK is designed for drop-in integration with existing payment authorization pipelines. No modification to settlement rails, message formats, or clearing infrastructure is required. The SDK exposes three REST endpoints suitable for integration with any backend technology stack:

The typical integration pattern for a payment authorization workflow is as follows: (1) the core banking system or payment gateway constructs the authorization object; (2) before the instruction enters the settlement rail, the system calls POST /authenticate with the authorization object and the operator's IAM credential; (3) on receipt of a verified signed token, the token is attached to the payment message as a quantum-authenticated authorization header; (4) the signed token travels with the instruction through the rail; (5) at settlement, the receiving institution's system calls POST /verify to confirm the authorization is cryptographically valid. The signing key that produced the authorization no longer exists — it was destroyed within milliseconds of creation — but the verification remains unconditionally valid.

9.Hardware Escalation: PALLAS Enterprise

The software SDK characterizes the QSK ceremony's cryptographic properties and latency profile on commodity hardware. The PALLAS Enterprise device — Pilon Laboratories' banking-grade hardware variant — replaces each software-emulated component with purpose-built silicon, enforcing the same ceremony at hardware level with no key material ever accessible to host software. Core components are identical across consumer and enterprise variants; the enterprise configuration adds an institutional-grade enclosure, enterprise fleet management firmware, and a FIPS 140-3 Level 3 certification pathway:

On the PALLAS Enterprise device, the total QSK ceremony target is 50–150 ms, with QRNG entropy acquisition measured in microseconds (vs. 0.08 ms software CSPRNG and 62–450 ms NIST Beacon). The SLC27 TEGRION's native post-quantum coprocessor is expected to reduce key generation and signing times to sub-millisecond ranges. The software SDK figures reported in Section 6 therefore represent a conservative baseline; production hardware performance will be reported separately following prototype validation.

Figure 1. PALLAS Enterprise — officer-desk deployment. Matte obsidian aluminum chassis with biometric signing interface and status indicator. Pre-production render.

9.1 PALLAS Enterprise QEV Edition — Integrated Quantum-Encrypted Vault

The PALLAS Enterprise QEV Edition extends the base signing module with a physically isolated quantum-encrypted document vault on a dedicated PCB partition. The vault section carries no electrical path to the network-connected signing module — it is air-gapped by design, accessible exclusively via biometric authentication at the device itself. Every file operation (write, read, delete) triggers an independent QSK ceremony, producing a unique ML-DSA-87 signature bound to that operation. Files are stored in the PALLAS Quantum Encrypted Vault format and never traverse any network interface under any operating mode.

Internal NVMe storage supports up to 245 TB per drive using enterprise E3.L form-factor NVMe (Kioxia LC9-class, PCIe Gen5, QLC NAND with CBA packaging — currently in enterprise sampling, targeted for commercial availability ahead of the Q2 2027 PALLAS Enterprise delivery window). A dual-drive configuration supports up to 491 TB behind the tamper boundary. The vault is appropriate for board-level communications, M&A documentation, regulatory correspondence, and any class of material whose sensitivity requires air-gapped physical custody. Officers retain their vault data on the physical device; no cloud, no server, no network path exists.

9.2 Commercial Rollout — Two-Phase Deployment Strategy

PALLAS Enterprise is offered under a phased commercial model. Phase 1 allows institutions to begin evaluating the QSK architecture immediately via software SDK, generating recurring revenue that funds ongoing hardware engineering. Phase 2 delivers the complete Chrono-Isolated Secrecy enforcement stack at silicon level. Phase 1 sandbox and licensing fees are credited in full against Phase 2 Year 1 costs upon execution of a production agreement.

Phase 1 — Software-Only SDK Infrastructure (Available Now)

Phase 2 — Hardware-Bonded Ecosystem (Production — Q2 2027)

Pre-certification pricing reflects early-adopter access. Post-certification pricing reflects the fully FIPS 140-3 Level 3 validated production configuration. Hardware pricing is one-time per unit. All prices USD. Volume fleet and multi-jurisdiction arrangements subject to bespoke negotiation.

10.Conclusion

The QSK architecture and its Chrono-Isolated Secrecy property represent a principled response to the convergence of two threats facing financial institutions: the imminent arrival of cryptographically-relevant quantum computers, and the structural vulnerability introduced by long-lived private keys in legacy HSM deployments. By eliminating key persistence as a design property — rather than merely protecting it through hardware enclosure — QSK removes an entire attack surface class from the threat model.

The Node.js benchmark data presented in this paper establishes the software baseline: 23.91 ms mean ceremony latency (CSPRNG, concurrency=1), 41.80 ceremonies per second sustained throughput, and under 0.01 ms key destruction time on commodity hardware with no cryptographic acceleration. 4,992 bytes of key material per ceremony were confirmed all-zeros via readback verification across all 4,200 ceremonies in the full concurrency matrix. Throughput remained stable at 40–44 TPS across concurrency levels 1, 5, 10, and 25, confirming algorithm consistency under concurrent load. Signed records remain independently verifiable via retained ephemeral public keys indefinitely, providing a cryptographically sound audit trail compatible with regulatory inquiry requirements.

We invite Chief Quantum Risk Officers and their cryptographic architecture teams to evaluate the PALLAS Auth SDK within their sandbox environments under a structured Paid Proof-of-Concept agreement. The SDK is deployable in fully air-gapped environments, requires no modification to existing payment rail infrastructure, and produces signed authorization tokens compatible with any downstream settlement system capable of accepting structured JSON metadata.